Absent Member.
Absent Member.
574 views

Logger Report Results is empty

I try create report in logger this is step and i dont have results in report like i have results in the query in logger, please help me.

1. step: Results in the logger

img01.jpg

2. step create report and query

img02.jpg

img03.jpg

3. step: Preview this report in same time and same devices

img04.jpg

4. step : Result is empty. I must have one result

img05.jpg

Please that is wrong !

Labels (2)
Tags (3)
0 Likes
7 Replies
Micro Focus Expert
Micro Focus Expert

What time did the events come to Logger?

Can you adjust your report time to cover that time span (event.arc_endTime) and not events.arc_eventTime?

And see what happens?


0 Likes
Absent Member.
Absent Member.

Thanks Aaron Kramer

I use now event.arc_endTime but results is the same = empty reports.

0 Likes
Absent Member.
Absent Member.

Did you try and selecting:

Device Groups and Storage Groups

When I get a report to run in Logger I always chose something in these tabs.

David

0 Likes
Absent Member.
Absent Member.

Hi Vladimir,

Is the disk space available on Logger. Please also check if the logger might hung, we did face same issue in our case logger was hung and we were receiving empty report.

Regrads,

Chetan C

0 Likes
Absent Member.
Absent Member.

I am also facing the same issue and unable to get the report generated from arcsight logger with admin account.

Tried all types of report options but not giving any log output but the same log is available in the log analyzer. It is the fresh install and done on two different servers with the same issue. Either I might missed some step or there is something wrong with installer.


0 Likes
Micro Focus Expert
Micro Focus Expert

In the search it looks like you are selecting certain device groups, while in your report it looks like you are selecting different devices. It also looks like you are selecting eventTime in the report but deviceReceiptTime in the search.

Did these events come into Logger as they happened? Or were they loaded later? You may be seeing different timestamps.

Try to NOT select any device groups, and no devices, and open the report times to when the events came into Logger. If the event is in there, there is no reason it cannot appear in a report.


0 Likes
Absent Member.
Absent Member.

In My case I am sending the syslogs by using smart connectors to the arcsight logger server directly. I can browse those events in the analyzer tab but when I try to generate report out of it, itz empty.

There are many failed login attempts in the events which I can search but it does not come in report.

--vikas



0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.